zfs noexec override, sort of.



Hi,

Not sure if it's a real security issue, or if it's a feature.
ZFS allows the admin to create noexec volumes, so that users won't be able to execute binaries sitting on these volume. But as soon as one of these binaries is available on a snapshot, it becomes available for the user to execute:

# zfs create tank/test-exec
# ls
test-exec
# zfs get -r exec tank/test-exec
NAME PROPERTY VALUE SOURCE
tank/test-exec exec off local
# cp /bin/ls /tank/test-exec/
# /tank/test-exec/ls
bash: /tank/test-exec/ls: Permission denied
# zfs snapshot tank/test-exec@noexec
# zfs get -r exec tank/test-exec
NAME PROPERTY VALUE SOURCE
tank/test-exec exec off local
tank/test-exec@noexec exec off inherited from tank/test-exec
# /tank/test-exec/.zfs/snapshot/noexec/ls
test-exec

Once the snapshot is accessed, it's mounted automatically, and gets back an exec=on property:

# zfs get -r exec tank/test-exec
NAME PROPERTY VALUE SOURCE
tank/test-exec exec off local
tank/test-exec@noexec exec on temporary

So it makes it very easy for a user to install and use binaries on a shared server where (for example) every home is a ZFS volume with daily snapshots.

regards,
patpro



Relevant Pages

  • Re: (mirroring &) ZFS: 9=no-ZFS; 10=yes?; 11=open=ZFS (improved)?
    ... increments of whole snapshots... ... incorrect use of ZFS. ... Not terribly backup friendly ... off of a snapshot, which is effectively instantaneous. ...
    (comp.unix.solaris)
  • Re: Musings on ZFS Backup strategies
    ... ZFS' snapshot capabilities have forced me to re-think the way that I've ... Previously near-line backup was focused on ... and the online snapshot increments and retention are ...
    (freebsd-stable)
  • Re: Musings on ZFS Backup strategies
    ... the form of a filesystem rather than as 'zfs send' streams. ... Another reason is that it means I can do 'rolling snapshot' backups. ... That pipe can obviously go through ssh or whatever to put the backup on ... send side but at a snapshot called @dump on the recv side. ...
    (freebsd-stable)
  • Re: Musings on ZFS Backup strategies
    ... Take a base snapshot immediately and zfs send it to offline storage. ... For backup purposes it's worth using the -R and -I options to zfs send ... Then to make an increment I roll forward the ...
    (freebsd-stable)
  • Re: Musings on ZFS Backup strategies
    ... the latest snapshot was taken. ... snapshot for longer than it takes to zfs send it, ... It's also worth noting that whilst the stream will ... That's no more of a problem than it is for a dump file saved on a disk ...
    (freebsd-stable)